The Elasticsearch backend in django-haystack calls Python's eval() function on raw field values returned from Elasticsearch when a SearchField is declared with an index_fieldname alias differing from the logical field name. Because Elasticsearch stores documents under the alias key but the backend looks up fields by logical name, the lookup fails and the value is passed to _to_python(), which unconditionally calls eval() on it. This allows an attacker who can control indexed content and trigger a search returning that content to execute arbitrary code in the Django application process. The Solr backend correctly remaps aliases before lookup, but the Elasticsearch backend lacks this remapping, causing the vulnerability. The vulnerability affects django-haystack versions before 3.4.0.

Successful exploitation allows an attacker who can inject data into Elasticsearch and trigger a search returning that data to execute arbitrary Python code within the Django application process. This can lead to full compromise of the application environment, data theft, or further attacks. The vulnerability is rated high severity (CVSS 4.0 vector indicates high impact on confidentiality, integrity, and availability).

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using index_fieldname aliases different from logical field names in SearchFields with the Elasticsearch backend, or restrict user input that can be indexed to prevent injection of malicious payloads. Monitor vendor channels for updates and apply patches promptly once released.